p PatchFirst

CVE-2026-82522

CVE-2026-82522 · libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads.

CVSS 5.3 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libjxl

    Versions
    • ≥ 0, < 0.12.0: Affected (semver)

    Update to 0.12.0

  • jpeg-xl Debian:12

    Versions
    • 0.10.3-1
    • 0.10.3-2
    • 0.10.3-3
    • 0.10.3-4
    • 0.10.3-5
    • 0.10.4-1
    • 0.10.4-2
    • 0.11.1-1
    • 0.11.1-2
    • 0.11.1-3
    • 0.11.1-4
    • 0.11.1-5
    • 0.11.1-6
    • 0.11.2-0.1
    • 0.11.2-0.1~deb13u1
    • 0.11.2-0.1~deb13u2
    • 0.11.2-1
    • 0.11.2-2
    • 0.11.2-3
    • 0.11.2-3~exp1
    • 0.11.2-4
    • 0.11.2-5
    • 0.11.2-5.1
    • 0.7.0-10
    • 0.7.0-10+deb12u1
    • 0.7.0-10.1
    • 0.7.0-10.2
    • 0.8.0-1
    • 0.8.0~git20221120.4167056-1
    • 0.8.0~git20221123.8bf8deb-1
    • 0.8.0~git20230102.26a5158-1
    • 0.8.0~git20230118.bcacd51-1
    • 0.8.0~git20230125.a67e970-1
    • 0.8.1-1
    • 0.8.1-2
    • 0.8.2-1
    • 0.8.2-2
    • 0.8.2-3
    • 0.8.2-4
    • 0.9.0~git20230612.38b629f-1
    • 0.9.0~git20230612.38b629f-2
    • 0.9.0~git20230612.38b629f-3
    • 0.9.0~git20230612.38b629f-4
    • 0.9.0~git20230623.689da0f-1
    • 0.9.0~git20230623.689da0f-2
    • 0.9.0~git20230623.689da0f-3
    • 0.9.0~git20230623.689da0f-4
    • 0.9.2-1
    • 0.9.2-10
    • 0.9.2-2
    • 0.9.2-3
    • 0.9.2-4
    • 0.9.2-5
    • 0.9.2-6
    • 0.9.2-7
    • 0.9.2-8
    • 0.9.2-9
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jpeg-xl Debian:13

    Versions
    • 0.11.1-4
    • 0.11.1-5
    • 0.11.1-6
    • 0.11.2-0.1
    • 0.11.2-0.1~deb13u1
    • 0.11.2-0.1~deb13u2
    • 0.11.2-1
    • 0.11.2-2
    • 0.11.2-3
    • 0.11.2-3~exp1
    • 0.11.2-4
    • 0.11.2-5
    • 0.11.2-5.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jpeg-xl Debian:14

    Versions
    • 0.11.1-4
    • 0.11.1-5
    • 0.11.1-6
    • 0.11.2-0.1
    • 0.11.2-0.1~deb13u1
    • 0.11.2-0.1~deb13u2
    • 0.11.2-1
    • 0.11.2-2
    • 0.11.2-3
    • 0.11.2-3~exp1
    • 0.11.2-4
    • 0.11.2-5
    • 0.11.2-5.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jpeg-xl Ubuntu:24.04:LTS

    Versions
    • 0.7.0-10ubuntu2
    • 0.7.0-10.2ubuntu1
    • 0.7.0-10.2ubuntu4
    • 0.7.0-10.2ubuntu5
    • 0.7.0-10.2ubuntu6
    • 0.7.0-10.2ubuntu6.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jpeg-xl Ubuntu:26.10

    Versions
    • 0.11.1-6ubuntu4
    • 0.11.1-6ubuntu5
    • 0.11.2-5ubuntu1
    • 0.11.2-5.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jpeg-xl Ubuntu:26.04:LTS

    Versions
    • 0.11.1-4
    • 0.11.1-6ubuntu1
    • 0.11.1-6ubuntu3
    • 0.11.1-6ubuntu4
    • 0.11.1-6ubuntu4.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →